An unauthorised payment: act quickly and keep the evidence
If a debit appears that you did not authorise, act promptly and keep a precise record. This guide separates immediate bank and cybercrime reporting from the later liability investigation, explains the date-sensitive RBI framework and helps you prepare a clear complaint.
In this article
- Notify the bank before building a perfect evidence file
- Contain compromised access without destroying the record
- Use cybercrime reporting alongside the bank complaint
- Distinguish unauthorised use, deception and technical failure
- Read the current bank-account liability conditions carefully
- Ask about provisional credit and the liability decision
- Build a concise complaint file that another person can follow
- Escalate under the current Ombudsman process
- Sources & further reading
Notify the bank before building a perfect evidence file
If you believe a transaction was unauthorised, contact the bank immediately using its genuine app, card, statement or official website. Identify the amount, time, account or card and transaction reference if available. Ask the bank to register the unauthorised-transaction complaint and restrict affected services as appropriate. Request an acknowledgement or case number. Do not postpone reporting until you have assembled every screenshot or visited a branch during office hours.
Write down when you first received or noticed the transaction communication, when you contacted the bank and what response you received. A call log alone may not describe the complaint, so retain any confirmation and follow up through a documented bank channel. If you cannot reach one reporting route, try another official route and record the difficulty. Prompt notice matters both for containment and for the liability framework; reporting to a merchant or posting publicly does not necessarily notify your bank.
Contain compromised access without destroying the record
If a phone, SIM, password or remote session may be compromised, tell the bank what happened and ask which services need blocking. From a trusted device, secure connected accounts and use supported lost-device controls. Contact the mobile operator if the number is lost or there is suspicious service interruption. Do not continue entering banking credentials into a device while a stranger can observe or control it.
Preserve the relevant messages, payment references and app details before unnecessary deletion, but do not remain connected to an attacker just to gather evidence. Technical cleanup can follow trusted device guidance after urgent financial reporting. Explain whether you disclosed an OTP, installed an app, approved a payment or noticed a debit without interaction. Accurate facts are more useful than withholding an embarrassing detail or guessing an explanation that later conflicts with the records.
Section references: [5]
Use cybercrime reporting alongside the bank complaint
For suspected financial cyber fraud, use 1930 or the National Cybercrime Reporting Portal at cybercrime.gov.in. Be ready with contact information, the bank or wallet involved, transaction date, amount and reference, and the information you have about the recipient or fraudulent communication. Follow the acknowledgement message and portal instructions to complete the report. Keep the cybercrime acknowledgement separate from the bank’s complaint number so you can identify each process accurately.
These routes support reporting and investigation; they do not promise that funds can always be stopped or recovered. The speed and outcome depend on the transaction and where the money has moved, among other facts. Do not wait for one organisation to finish before informing the other. If the facts involve a mistaken successful transfer rather than fraud, describe them honestly and use the bank’s relevant process instead of relabelling the event to obtain a faster response.
Section references: [4]
Distinguish unauthorised use, deception and technical failure
A debit you did not authorise, a payment you made after being deceived and a failed payment where money was debited are not automatically the same kind of complaint. State the sequence: who initiated contact, what the screen showed, what you approved and what actually happened. The bank must assess the facts under the applicable framework. The mere presence of an OTP or authentication record does not relieve you of the need to explain the circumstances fully.
This article is dated 4 November 2026. RBI issued final amendments on 24 June 2026 that broaden the customer-protection framework and apply to electronic banking transactions undertaken on or after 1 January 2027. They are not already applicable merely because they have been published. For an earlier transaction, ask the bank to identify the rules and policy it applies. Non-bank wallets and other products can have separate provisions; do not transplant a bank-account explanation without checking coverage.
Read the current bank-account liability conditions carefully
Under the RBI framework applicable before the January 2027 amendments, a customer has zero liability where the unauthorised transaction results from bank fraud, negligence or deficiency, irrespective of reporting time. For a third-party breach where neither the bank nor customer is responsible, reporting within three working days of receiving the bank’s communication is a condition for zero liability. This is why the phrase report within three days and every fraud is refunded is misleading.
Where loss results from customer negligence, such as sharing payment credentials, the framework places the loss before reporting on the customer; losses after reporting are borne by the bank under the stated provisions. Third-party cases reported in four to seven working days have category-dependent limits, while later reporting is governed by the bank’s approved policy. Working days follow the home branch schedule and exclude the communication date. Ask for the applicable category and calculation, rather than assuming calendar-day counting or a universal rupee cap.
Section references: [1]
Ask about provisional credit and the liability decision
The pre-January 2027 RBI bank framework provides for shadow reversal within ten working days of notification and resolution of the complaint and determination of liability within the prescribed policy period, not exceeding 90 days. It also addresses value dating and avoiding specified interest burdens. A provisional or shadow credit should not be confused with final acceptance of your claim. Ask the bank to explain its status and any restrictions in writing.
The burden of proving customer liability lies with the bank under that framework. Request a reasoned response if the bank attributes negligence to you, and provide the evidence you hold. Keep a dated chronology of calls, messages and actions. Do not assume that a generic support message closes the question of liability. Equally, do not spend a provisional credit on the assumption that it can never be reversed; clarify the bank’s determination and the applicable conditions.
Section references: [1]
Build a concise complaint file that another person can follow
Use a chronology with the transaction date and time, notice received, action taken, report numbers and subsequent communication. Attach the relevant statement entry, messages, recipient details and screenshots without editing the originals. Keep a separate copy for redacted sharing. Never put passwords, PINs or live OTPs in the complaint narrative. If a document is unavailable, say so and identify what you have requested from the bank or operator.
State the remedy you seek: investigation, applicable credit, correction of interest or charges, and a reasoned written decision. Distinguish the amount lost from other expenses you want considered. Update an existing complaint reference rather than creating a confusing stack of inconsistent accounts. A trusted helper can organise papers while you retain control of credentials. The file should explain what happened, not make unsupported accusations against a person whose name appeared on a payment screen.
Escalate under the current Ombudsman process
First complain to the regulated entity through its official grievance process. RBI’s Integrated Ombudsman Scheme, 2026 took effect on 1 July 2026. Its eligibility conditions consider an unsatisfactory response or the applicable waiting period, and complaints must meet a 90-day filing calculation. Where no reply arrives, the relevant period is the prescribed RBI, NPCI or card-network timeline or 30 days, whichever is later. Read the current FAQ for your circumstances before filing through CMS.
Do not rely on old articles stating a one-year window for every new complaint. Keep the bank’s last communication and complaint date visible so you can calculate the current window correctly. Older proceedings have transitional rules. RBI grievance escalation does not replace urgent bank notification or a cybercrime report. Recheck this article’s date-sensitive liability guidance for transactions from January 2027 onward, and reject anyone who demands a payment or your banking credentials to guarantee recovery.
Readers’ questions
Will reporting within three days guarantee my money back?
No. The zero-liability condition depends on the category of unauthorised transaction and responsibility for the breach under the applicable framework. The three-working-day provision described here concerns qualifying third-party breaches, not every payment made under deception or every case involving credential sharing. Report immediately anyway, preserve the facts and ask the bank for its reasoned assessment under the rules applicable to your transaction date.
Should I wait for a police report before contacting the bank?
No. Notify the bank promptly and use the financial cybercrime reporting route alongside it when fraud is suspected. Keep both acknowledgements and follow their document requests. Waiting for one process to finish can delay containment and affect the record of your notice. Provide accurate information even if you do not yet know how the transaction happened or cannot obtain every supporting document immediately.
Can a recovery agent on social media get the money back faster?
Treat guaranteed recovery claims and advance-fee demands with caution. Use the bank, the official cybercrime reporting routes and eligible grievance mechanisms. A stranger should not need your banking password, UPI PIN or a verification payment to pursue a refund. If you engage professional assistance for a complex dispute, verify the person and scope independently; no adviser can promise a result regardless of the evidence.
Sources & further reading
- RBI: Customer Protection—Limiting Liability in Unauthorised Electronic Banking Transactions, 6 July 2017 ↗
- RBI: Commercial Banks—Responsible Business Conduct Third Amendment Directions, 24 June 2026; effective 1 January 2027 ↗
- RBI: Integrated Ombudsman Scheme, 2026 FAQs ↗
- Ministry of Home Affairs / PIB: Indian Cyber Crime Coordination Centre (I4C), 4 February 2026 ↗
- CERT-In: Cyber Security Awareness for Senior Citizens ↗
Sources were checked for this edition. Scheme rules, product conditions and local requirements can change; consult the responsible provider for a decision.